PDR Rug Pull

What happened

PDR was a BNB Smart Chain token built from a token-generator template (IncomeGeneratorToken). The constructor credits the entire 10,000 PDR supply to the deployer, and the owner can also block any address from sending tokens with a "sniper" flag and raise buy and sell taxes with no cap. On 2022-08-21 CertiK reported a rug pull: a wallet with connections to the deployer sold 208 PDR into the PancakeSwap pool for 85.4 BNB (about $24K), and the price fell more than 93%.

De.Fi lists the loss as about $25K.

How it happened

1. The constructor gives the whole supply to the deployer: _balances[_msgSender()] = _totalSupply;. With 9 decimals, the on-chain supply is 10,000 PDR, so 208 PDR is about 2% of it.
2. The owner can stop any address from sending tokens: require(!sniper[sender], "you are a sniper");, set through setIsSniper(address account) public onlyOwner. Because the check uses sender, a flagged holder cannot sell or transfer.
3. Taxes have no upper bound. setSellTaxes sets _totalTaxIfSelling = _sellLiquidityFee.add(_sellMarketingFee).add(_sellTeamFee); without a cap, and takeFee returns amount.sub(feeAmount). A tax of 100 leaves the seller nothing, and a tax above 100 makes sells revert. setMaxTxAmount can also be lowered without a floor, which blocks transfers by non-exempt wallets.
4. The listed outcome: CertiK reported that a wallet with connections to the deployer sold 208 PDR for 85.4 BNB in the PancakeSwap pool, and the price fell more than 93%. De.Fi names the deployer 0xebc35074…2d7e7a (address A) and 0x3cc77930…518037 (address B).

Protocol details

Classification Token

Protocol Type Exit Scam/Rugpull

Affected asset / contract PDR

Evidence

• report CertiK Alert on X: #CommunityAlert rugpull on $PDR twitter.com
• address PDR (IncomeGeneratorToken) contract source, BscScan verified code bscscan.com
• address bscscan.com address 0x3cc7…8037 bscscan.com
• address bscscan.com address 0xebc3…7e7a bscscan.com
• analysis Sourcify repository: chain 56, 0x11fcB937052c7cdfeAC85887a6e71510fc486CFd (IncomeGeneratorToken.sol) repo.sourcify.dev